This vulnerability arises from insufficient validation of untrusted input in the WebAppInstalls feature of Google Chrome versions before 150.0.7871.47. Exploitation requires a user interaction (UI:R) and can lead to remote code execution within the sandboxed environment. The CVSS vector indicates the attack can be performed remotely without privileges and with low attack complexity, resulting in high impact on confidentiality, integrity, and availability. The issue was publicly disclosed with a vendor advisory link provided, but explicit patch or remediation information is not detailed in the input data.

Successful exploitation allows a remote attacker to execute arbitrary code inside the Chrome sandbox, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8, reflecting critical impacts if exploited. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to version 150.0.7871.47 or later once confirmed patched. Until then, exercise caution with untrusted HTML content and consider limiting exposure to potentially malicious web pages.